System and method for supporting multiple certificate authorities on a mobile communication device

ABSTRACT

A system and method for supporting operations with multiple certification authorities (CAs) on a communication device. A common CA interface is provided between a plurality of secure communication applications and a plurality of CA-specific components, each of which interacts with a particular CA. A further common interface may also be provided for operatively coupling the secure communication applications to cryptographic components in the device.

CROSS-REFERENCE RELATED APPLICATION

This application claims priority from U.S. provisional application Ser.No. 60/305,667 entitled “A System And Method For Supporting MultipleCertification Authorities On A Mobile Communication Device” filed Jul.16, 2001. By this reference, the full disclosure, including thedrawings, of U.S. provisional application Ser. No. 60/305,667 isincorporated herein.

BACKGROUND

1. Technical Field

This invention relates generally to the field of communications, and inparticular to secure communications.

2. Description of the State of the Art

In many modern communication systems, security of information is a majorconcern. When a communication system or medium cannot be physicallysecured, such as in wireless communication networks or wide areanetworks like the Internet, a secure communication scheme may becritical. For example, in so-called electronic commerce (e-commerce) andmobile commerce (m-commerce)transactions, credit card, financial orother confidential or sensitive information must be transferred betweenparties. Such information is normally encrypted before being sent over acommunication network and a receiver of the information then decryptsthe encrypted information to recover the original information.

A typical problem in secure communication systems is managing theencryption and decryption of information. One known secure communicationscheme is a so-called public key scheme, in which a public key is usedto encrypt information and a corresponding private key is used fordecryption. For example, if two parties, commonly referred to as “Alice”and “Bob” for illustrative purposes, wish to securely exchangeinformation, then Alice must be able to decrypt any informationencrypted for her by Bob and Bob must be able to decrypt any informationencrypted for him by Alice. In a public key system, Alice and Bob wouldeach use a respective secret or private key a, b to decrypt informationwhich was encrypted using a corresponding public key A, B. Therefore,Alice and Bob are able to decrypt information which was encrypted usingtheir respective public keys A, B. Similarly, in a public key system,any sender must use the public key for an intended receiver of theinformation. Even though others may know the values of the public keys,the corresponding private keys are required for decryption and are keptsecret. The public and private keys are normally designed such that ftis not computationally feasible to decrypt encrypted information orderive the private key using the public key.

Thus, in order for a sender to securely send information to a receiver,the sender must somehow obtain the receiver's public key; otherwise, thereceiver will be unable to decrypt the received information. This keydistribution function is normally performed by a certificate authority(CA), which maintains a record of public keys for a plurality of usersin the system. A sender can then obtain the receivers public key fromthe CA and use the public key to encrypt information to be sent to thereceiver. In the above example of Alice and Bob, Alice may contact a CAto obtain Bob's public key B and then use the public key to encrypttransmissions to Bob. Using the private key b, Bob is able to decryptany encrypted information received from Alice.

In known systems, a CA normally returns a digital certificate inresponse to a request for a public key. A digital certificate isgenerated by the CA and typically contains such certificate informationas a name of the entity to which the public key corresponds (commonlyknown as the subject name), a date the certificate was issued, thepublic key, and possibly other information. The CA generates a digitalsignature, which binds the entity or subject name to the public key, forexample by performing one or more preferably non-invertible mathematicaloperations such as a hash on the certificate and applying a private keyof the CA to the result. The certificate can then be validated byverifying this digital signature using the public key of the CA.

Some known systems similarly provide for verification of communicationsthrough private key-generated signatures. For example, when Alice wishesto communicate with Bob, Alice may generate a digital signature usingher private key a and append the digital signature to the information tobe transmitted. Bob can then use Alice's public key A to verify thedigital signature and thereby confirm that the information was actuallysent by Alice.

However, not every entity that may be involved in secure communicationsis registered with a single global CA. Many different CAs currentlyexist, any of which may be chosen by an entity to manage its public key.Since each CA may use different information transfer protocols, aninformation sender may need to support the transfer protocols ofmultiple CAs, for example where the particular operations orapplications resident on a system require access to different CAs. Incommunication devices such as mobile communication devices, which tendto have limited memory and processing resources, multiple CA supportbecomes particularly challenging.

SUMMARY

In accordance with the teachings disclosed herein, a system and methodare provided for supporting operations with multiple CAs on acommunication device. A common CA interface is provided between aplurality of secure communication applications and a plurality ofCA-specific components, each of which interacts with a particular CA. Afurther common interface may also be provided for operatively couplingthe secure communication applications to cryptographic components in thedevice. Further features of the system and method will be described orwill become apparent in the course of the following detaileddescription.

BRIEF DESCRIPTION OF THE DRAWINGS

In order that the invention may be more clearly understood, preferredembodiments thereof will now be described in detail by way of example,with reference to the accompanying drawings, in which:

FIG. 1 is a software block diagram of a known system for supportingmultiple CAs;

FIG. 2 is a system block diagram illustrating a communication systemwith multiple CAs;

FIG. 3 is a software block diagram illustrating an example of a mobiledevice that supports multiple CAs;

FIG. 4 is a software block diagram illustrating an alternative examplemobile device that supports multiple CAs;

FIG. 5 is a flowchart illustrating an operational scenario on a sendermobile device using a multiple CA handler;

FIG. 6 is a flowchart illustrating an operational scenario usingmultiple CA handler by a receiver mobile device;

FIG. 7 is a block diagram of an example wireless mobile communicationdevice.

DETAILED DESCRIPTION

FIG. 1 is a software block diagram of a known system for supportingmultiple CAs, which shows several software applications 42, 52, 62, 72,which may be resident on a wireless mobile communication device (“mobiledevice”). Each software application 42, 52, 62, 72 includes anapplication component 44, 54, 64, 74, a CA interface 46, 56, 66, 76 to arespective CA provider component 48, 58, 68, 78, and cryptographic(crypto) components 50, 60, 70, 80. Since communication with anothersystem such as a CA may require interaction with a communicationsubsystem of the mobile device, a radio interface 82 and radioapplication programming interface (API) 84 are also shown in FIG. 1.

A mobile device on which multiple CAs may be supported in accordancewith the teachings herein may, for example, be a data communicationdevice, a voice communication device, a dual-mode communication device,such as a mobile telephone having data communications capabilities,enabled for both voice and data communications, a two-way pager, apersonal digital assistant (PDA) enabled for communications, or adesktop, palmtop or laptop computer having a wireless modem. Other typesof mobile devices on which support for multiple CAs may also bedesirable or required will be apparent to those skilled in the art.

The CA interfaces 46, 56, 66, 76 provide an interface between acorresponding application component 44, 54, 64, 74 and a CA providercomponent 48, 58, 68, 78. The provider components enable communicationsbetween a CA and the mobile device application components. Cryptocomponents 50, 60, 70 and 80 are effectively encryption/decryptionmodules and perform such cryptographic functions as encryption, digitalsignature generation, decryption and digital signature verification.

The radio interface 82 and radio API 84 provide the applications 42, 52,62, 72 with access to the communication functions and capabilities ofthe communication device. Through the interface 82 and radio API 84, anapplication may perform any required communication functions by using,for example, function calls or other such software code or modulescompatible with the radio API 84.

With reference to one of the applications in particular, application 42,overall operation of the system in FIG. 1 will be described. During theexecution of application A 44, suppose that a certain operation requiresthat information be securely exchanged with a particular party. Throughthe corresponding CA interface A 46, the application 44 may invokeprocessing in the CA provider component A 48 to request a public key forthe other party from the particular CA. As described above, the requestmay be signed with a digital signature generated by the cryptocomponents A 50, and the request itself may also be encrypted by thecrypto components A 50. The provider component A 48 then sends therequest through the radio interface 82 and radio API 84 to theappropriate CA system (not shown), which may, for example, be configuredfor operation on the Internet or other network accessible to the mobiledevice.

When a certificate is received from the CA, the provider component A 48parses the certificate and passes the certificate and digital signature,if present, to the crypto components A 50 for decryption if necessaryand digital signature verification. After the certificate has beenverified, the public key therein, in conjunction with a cipher algorithmwhich the crypto components A 50 are configured to apply, can be used bythe crypto components to encrypt any information from the application A44 to be sent to the other party. The crypto components A 50 similarlyoperate to decrypt any received encrypted information for application A44 using the private key associated with the mobile device or a user ofthe mobile device and a cipher algorithm. Received digital signaturesmay be verified using a public key of a sender, which may be stored onthe mobile device or requested from a CA as described above.

A further function of the CA interface A 46, CA provider component A 48and crypto components A 50 for application A 44 is to provide the publickey associated with the mobile device or user to the corresponding CAwhen required. For example, if the device generates, selects or isotherwise provided with a new key pair including a new private key and anew public key, then the CA for application 42 should be updated toreflect the new public key. Otherwise, secure communication operationsbetween the mobile device application 42 and another party registeredwith the CA for application A 44 may fail. If the CA is not updated whena device key pair changes, the other party may retrieve an old copy ofthe public key of the mobile device or user from the CA and may then beunable to encrypt information in a format that can be decrypted at themobile device and may not be able to verify any digital signaturesappended to communications from the mobile device, since the mobiledevice and the other party are using keys from different key pairs. Theold private key may be used by the crypto components A 50 to generate adigital signature, and at least an identity associated with the mobiledevice or user, the new public key and the digital signature are thensent to the CA through the provider component A 48. The new public keywill normally be registered with the CA upon verification of the digitalsignature by the CA using the old public key.

As is apparent from FIG. 1, each application includes, in addition to anapplication component, custom CA-related and crypto components that arespecific to a particular CA or CA provider. In FIG. 1, applications 42,52, 62 and 72 use different CA providers A, B and C. Although more thanone of the applications might be configured for the same CA provider,separate interface, provider and crypto components are included in eachapplication in known systems. Therefore, each application is specific toa particular CA provider.

For example, application 42 may be a banking application, such that thecorresponding CA provider is chosen and trusted by the particular bankwith which application A is designed to operate. Similarly, theoperators of a confidential database may choose a different CA providerfor a remote database query application, application 72 for example,which would then be developed specifically for the particular CAprovider. Even if the same CA provider is selected for both the bankingapplication 42 and the remote query application 72, known systems do notprovide mechanisms whereby a CA interface, a CA provider component andcrypto components can be shared between applications. This may lead torelatively large application file size, which can quickly exhaustavailable memory and processing resources, particularly in suchcommunication devices as mobile devices with typically limited memoryspace and processing capabilities.

A multiple CA handler may be used to more efficiently process securemessages involving one or more CAs. There are many configurationspossible for the CA handler software. For example, FIG. 2 is a systemblock diagram illustrating a communication system with multiple CAs.FIG. 2 depicts use of multiple CA handlers 114, 124 on receiver mobiledevices 110, 120 for processing secure messages 104, 106 from a sender100.

The communication system shown in FIG. 2 includes a sender system 100, aWide Area Network (WAN) 101, three CAs 102, 112, 124, wirelessinfrastructure 103, a wireless communication network 105, and first andsecond receiver mobile devices 110, 120. Those skilled in the art willappreciate that communication systems may have many differenttopologies, and that the system shown in FIG. 2 is intended forillustrative purposes only. For example, although only one sender 100and two mobile devices 110, 120 are shown in FIG. 2, a typicalcommunication system may include thousands, or more, computers systemsand mobile devices. Senders and receivers may also communicate throughmultiple WANs and wireless networks.

The sender system 100 may, for example, be a personal computer, laptopcomputer, or palmtop computer, which is associated with a softwareapplication operating on the receiver mobile devices 110 and 120. Forexample, the sender system 100 may be a host system by which messagesaddressed to the sender system 100 are sent to a corresponding mobiledevice 110 or 120. The sender system 100 could also be an electronicmessaging client configured to send and possibly receive secure emailmessages. For an electronic banking application on a mobile device, thesender 100 may be a networked computer in a Local Area Network (LAN)installed at a bank. Other types of sender systems are alsocontemplated.

The WAN 101 will typically be the Internet. The sender 100, CAs 102,112, 122, and wireless infrastructure 103 may be connected to the WAN101 directly, as shown, or through an Internet Service Provider (ISP),Application Service Provider (ASP) or other intermediate system.

The three CAs 102, 112, 122 are associated with, and store the publickeys of, the sender 100, the first receiver 110 and the second receiver120, respectively. Even though the CAs 102, 112, 122 are associated withdifferent entities, i.e., the sender system 100 and receiver mobiledevices 110, 120, any of the entities can access any of the CAs throughthe WAN 101, such that any of the entities may exchange securecommunications with any of the other entities using public key cryptotechniques.

Wireless infrastructure component 103 may be a gateway system whichbridges the WAN 101 and the wireless network 105, providing suchfunctionality as protocol translation, mobile device addresstranslation, and any other operations required in order to delivercommunications from the WAN 101 to the mobile devices 110, 120. Althoughshown in FIG. 2 as a separate component, wireless infrastructure 103 mayform part of the WAN 101 or wireless network 105, or both networks mayincorporate some of the functionality of the wireless infrastructure103.

The mobile devices 110, 120 are configured for operation within thewireless network 105, which may be any of a plurality of differentwireless communication networks. An example mobile device is describedin further detail below in conjunction with FIG. 7.

In a secure messaging system, the sender 100 may use its own private keyto generate digital signatures for secure messages 104, 106 that are tobe sent. The sender 100 may also communicate with the receivers'respective CAs 112, 122 to obtain each receiver's public key to encryptthe messages 104, 106. The sender 100 may communicate with each CAthrough a custom CA interface as shown in FIG. 1 and described above, ormay also include a multiple CA handler (not shown). Communications withany of the CAs shown in FIG. 2 may be established through the WAN 101.In some systems, CAs may instead be connected in a LAN for access by anycomputer systems, and possibly mobile devices, configured for access tothe LAN.

The secure messages 104, 106 from the sender 100 ultimately aretransmitted to the receiver mobile devices 110, 120. The mobile devices110, 120 include multiple CA handlers 114, 124, which may be implementedas software modules, for example, to more efficiently process the securemessages 104, 106 with respect to the CAs 102, 114, 124 involved.Processing may include decryption, as well as other security processing,such as digital signature verification. Normally, when a public keyand/or certificate information is required by a mobile device 110, 120,a request is submitted to the appropriate CA, which returns a digitalcertificate and possibly other certificate information to the mobiledevice 110, 120.

The nature and content of the secure messages 104, 106 may be differentfor different types of operations or software applications. For example,in the context of a banking software application operating on the mobiledevices 110, 120, the secure messages 104, 106 may include transactionor financial information, and a multiple CA handler on the receivermobile devices 110, 120 may retrieve public key(s) required for digitalsignature verification and/or decryption from one or more CAs.

It should be noted that, as shown in FIG. 2, not all parties to acommunication exchange must necessarily implement a multiple CA handler.A multiple CA handler simplifies interactions between a mobile deviceand a CA, but is an optional component that preferably does not affectactual communications between mobile devices and other recipients.Multiple CA handlers provide a mechanism for obtaining digitalcertificates and possibly further certificate information from one ormore CAs, but may be implemented so as not to change the way in whichcommunication signals generated using such information are transmittedor received.

FIG. 3 is a software block diagram illustrating an example of a mobiledevice that supports multiple CAs. The mobile device 300 includes acommon CA interface 306 instead of multiple custom interfaces. Themobile device 300 uses crypto interfaces 309, 319 and 329, and mayinclude a single set of crypto components 310 to replace the customcrypto components of FIG. 1, or may instead use the custom cryptocomponents.

In the mobile device 300, software applications 304, 314, 324, 334 areconfigured to operate with the common CA interface 306 instead of aparticular CA or CA provider. An application communication link isprovided between the common CA interface 306 and each application 304,314, 324, 334, through which data, such as a security-related requestfor information for a CA from an application and information returned bya CA in response to such a request, may be exchanged with theapplications. It should be understood that a mobile device 300 maysupport an application using the common CA interface 306 to obtaininformation from a CA, as well as other applications using customcomponents particular to a CA. A mobile device in which a multiple CAhandler has been implemented may thereby be backwards compatible witholder software applications using custom components to communicate witha CA.

When information is exchanged with a CA (such as to register or requesta public key for example), an application invokes any requiredprocessing at the appropriate CA provider component 308, 318, 328. Ifnecessary, to encrypt information to be sent to the CA or to generate adigital signature for example, the provider component then sendscrypto-related requests and information to the device crypto components310 for processing via its respective crypto interface 309, 319, 329.Encrypted information and/or digital signatures are similarly receivedby a provider component (e.g., 308, 318, 328) from the crypto components310 through its interface 309, 319, 329. In FIG. 3, encryption,decryption, and digital signature generation or verification operationsare performed in the single set of device crypto components 310.

Information is preferably sent from and received by the applications304, 314, 324, 334 through the radio interface 342 and the radio API344. Each application 304, 314, 324, 334 may incorporate a softwaremodule or set of function calls associated with the radio interface 342and/or the radio API 344. It is also possible that one or more of theprovider components 308, 318, 328 may include such modules or functioncalls associated with the radio interface 342 and/or API 344 in order toexchange information with a CA directly, although the arrangement shownin FIG. 3 may provide for a more compact software system, since only thesoftware applications, not both the software applications and providercomponents, incorporate radio software modules.

The applications 304, 314, 324, 334 are shown as applications involvingsecure communications. These applications may be shopping or othere-commerce applications, electronic messaging applications, bankingapplications, query or search applications for confidential remotedatabases, for example, but may be any applications for which secureinformation transfer may be desired or required. However, it should beunderstood that a mobile device may also include further applications(not shown), including applications providing communication functions,that do not require secure communications. More or fewer than theexample four secure communication applications shown in FIG. 3 may alsobe resident on a device. The multiple-CA support arrangements describedherein are in no way limited to a particular number or type ofapplication.

For an application developer, the common CA interface 306 provides asingle interface for communicating with a CA. Applications need not beCA-specific and may be written for operation with the common interface306. Application developers therefore may elect to design a singlestandardized application interface.

In addition, the application development process is not dependent uponthe particular CA or CA provider that will eventually be used for securecommunications associated with the application. An application isdeveloped on the basis of the common interface 306, the information thatmay be provided to or required from the application by the common CAinterface 306, and the format of such information. A particular CA orprovider can then be chosen after the application has been substantiallycompleted, or even after the application has been installed on a mobiledevice. For example, a particular CA may be chosen from those for whichthe associated provider component 308, 318, 328 is resident on a mobiledevice. The common CA interface 306 may then act as a router of asecurity-related request to such a chosen provider component and handlethe details needed for the request to be understood by the chosenprovider component. The common interface 306 may also provide forchanging the selected CA for an application, or possibly interaction ofa single application with more than one CA.

Provider software code, including a provider component (e.g., 308, 318,328) and a crypto interface 309, 319, 329, is accessible to and usableby more than one application. Applications which use the same CA orprovider, such as applications A and D 304, 334 for example, can therebyshare a single copy of the provider A software code 308. The totalmemory space occupied by secure communications applications andassociated provider code can thereby be reduced, relative to memoryrequirements for known systems such as shown in FIG. 1.

A CA provider component 308, 318, 328 may similarly be developed foroperation with the common interface 306. CA-specific protocols andinformation formats are thereby effectively “hidden” from the mobiledevice applications. By adapting its respective provider component foroperation with the common interface 306, a CA or provider may make itsservices available to any application on a mobile device instead of onlyto custom or specially developed applications.

Crypto interfaces 309, 319, 329 may perform such functions ascertificate parsing, in order to provide certificate and key informationto the device crypto components 310 that are shared between all securecommunication applications on a mobile device. For example, cryptointerface A 309 may be an X.509 certificate parser, crypto interface B319 may be an X9.68 certificate parser, whereas crypto interface C 329may parse some other type of certificate. The device crypto components310 may then be configured to process information from any of theseparsers. Thus, a single set of device crypto components 310 providescryptographic functions for all device secure communicationapplications.

A common CA interface 306 may provide for memory space savings in thateach application need not include CA-specific components, andapplications using the same CA or provider may share a providercomponent and crypto interface.

Further memory space savings may be realized by adapting providercomponents to operate with a single set of device crypto components.FIG. 4 is a software block diagram illustrating an alternative examplemobile device that supports multiple CAs. In FIG. 4, the mobile device400 includes a common crypto interface 411 between the CA providercomponents 408, 418, 428 and the crypto components 410. CA providercomponents 408, 418, 428 are adapted to operate with the common cryptointerface 411. The common crypto interface 411 provides access to thedevice crypto components 410 for the secure communication applicationsand provider components on the mobile device 400, by providingcrypto-related requests for crypto functions to the device cryptocomponents, for example.

The supported CA providers may use the same type of certificates, suchthat certificate parsing for all providers may be performed at thecommon crypto interface 411 instead of by each provider component 408,418, 428. The provider components 408, 418, 428 then pass receivedcertificates to the interface 411. This arrangement allows a singleparser to be used on the mobile device, instead of a parser for eachprovider component, such as described above in reference to the cryptointerfaces 309, 319, 329 in FIG. 3. A CA provider which uses a differenttype of certificate may adapt its respective provider component 408,418, 428 to incorporate a certificate translation function to therebyallow operation of its CA system with the device applications and cryptocomponent 410. It should also be understood that one or moreapplications may use the common crypto interface 411 while anotherapplication uses its own crypto components, or includes a custominterface to the crypto components 410.

FIG. 5 is a flowchart illustrating an operational scenario on a sendermobile device using a multiple CA handler. As described above, amultiple CA handler may, for example, be implemented as a softwaremodule. With reference to FIG. 5, start block 500 indicates that atprocess step 502 a first application wishes to create and send a securemessage from the mobile device. The first application uses the multipleCA handler to obtain certificate information from each of the receivers'CAs at step 504, so as to encrypt the message, for example. Certificateinformation will normally be provided in the form of a digitalcertificate, which typically includes at least a public key, and asubject name or other identification information bound to the public keyby a digital signature. Digital certificates also often include expiryand validity information for the certificate. However, the type ofcertificate information provided by a CA may be different for differentCAs, and need not necessarily be provided in the form of a digitalcertificate. In this description and the appended claims, certificateinformation includes any information, in a digital certificate or otherformats, provided by a CA.

At step 506, the secure message is created through use of the obtainedcertificate information, and the secure message is transmitted to one ormore receivers at step 508. When the secure message has been sent, theprocess ends at step 510.

The method shown in FIG. 5 may be repeated each time a softwareapplication is to create a secure message. A security-related requestfrom the software application may be sent to an appropriate CA providercomponent through a common CA interface in order to obtain certificateinformation to be used in preparing the secure message from a respectiveCA.

FIG. 6 is a flowchart illustrating an operational scenario using amultiple CA handler by a receiver mobile device. With reference to FIG.6, start block 600 indicates that a secure message is received by amobile device at step 602. At step 604, a determination is made as towhether a digital signature needs to be processed. The message isfurther processed and used by the mobile device at process block 610where such processing need not be performed.

If a digital signature is involved as determined at step 604, then asoftware application on the receiver mobile device uses the multiple CAhandler to obtain the senders certificate information at step 606. Atprocess block 608, the digital signature is verified using the obtainedcertificate information. The message is further processed and used bythe mobile device at process block 610. Processing for this exampleterminates at end block 612.

It will be appreciated that the above description relates to preferredembodiments by way of example only. Many variations on the inventionwill be obvious to those knowledgeable in the field, and such obviousvariations are within the scope of the invention, whether or notexpressly described. For example, although described primarily in thecontext of a mobile communication device, the systems and methodsdescribed herein are in no way limited thereto. These systems andmethods are also applicable to other types of communication devices,including non-mobile devices. Mobile devices such as mobile datacommunication devices, mobile email devices, cellular telephones,two-way pagers and PDAs enabled for communications tend to have morelimited memory and processing resources than other devices, includingfor example wired or wireless modems connected to computer systems, andmay therefore derive greater benefit from the memory savings associatedwith the above systems and methods. However, these systems and methods,in addition to conserving memory space, provide flexibility inCA-related operations and thus provide further benefits for applicationdevelopers and CA providers regardless of the type of communicationdevice.

The system and method described above may be implemented in conjunctionwith many different types of mobile device. FIG. 7 is a block diagram ofone such example wireless mobile communication device. The mobile device700 is a dual-mode mobile device and includes a transceiver 711, amicroprocessor 738, a display 722, Flash memory 724, random accessmemory (RAM) 726, one or more auxiliary input/output (I/O) devices 728,a serial port 730, a keyboard 732, a speaker 734, a microphone 736, ashort-range wireless communications sub-system 740, and may also includeother device sub-systems 742.

The transceiver 711 includes a receiver 712, a transmitter 714, antennas716 and 718, one or more local oscillators 713, and a digital signalprocessor (DSP) 720. The antennas 716 and 718 may be antenna elements ofa multiple-element antenna, and are preferably embedded antennas.However, the systems and methods described herein are in no wayrestricted to a particular type of antenna.

Within the Flash memory 724, the device 700 preferably includes aplurality of software modules 724A-1124N that can be executed by themicroprocessor 738 (and/or the DSP 720), including a voice communicationmodule 724A, a data communication module 724B, and a plurality of otheroperational modules 724N for carrying out a plurality of otherfunctions.

The mobile device 700 is preferably a two-way communication devicehaving voice and data communication capabilities. Thus, for example, themobile device 700 may communicate over a voice network, such as any ofthe analog or digital cellular networks, and may also communicate over adata network. The voice and data networks are depicted in FIG. 7 by thecommunication tower 719. These voice and data networks may be separatecommunication networks using separate infrastructure, such as basestations, network controllers, etc., or they may be integrated into asingle wireless network.

The transceiver 711 is used to communicate with the network or networks719, and includes the receiver 712, the transmitter 714, the one or morelocal oscillators 713 and may also include the DSP 720. The DSP 720 isused to send and receive signals to and from the transceivers 716 and718, and may also provide control information to the receiver 712 andthe transmitter 714. If the voice and data communications occur at asingle frequency, or closely-spaced sets of frequencies, then a singlelocal oscillator 713 may be used in conjunction with the receiver 712and the transmitter 714. Alternatively, if different frequencies areutilized for voice communications versus data communications forexample, then a plurality of local oscillators 713 can be used togenerate a plurality of frequencies corresponding to the voice and datanetworks 719. Information, which includes both voice and datainformation, is communicated to and from the transceiver 711 via a linkbetween the DSP 720 and the microprocessor 738.

The detailed design of the transceiver 711, such as frequency band,component selection, power level, etc., will be dependent upon thecommunication network 719 in which the mobile device 700 is intended tooperate. For example, a mobile device 700 intended to operate in a NorthAmerican market may include a transceiver 711 designed to operate withany of a variety of voice communication networks, such as the Mobitex™or DataTAC™ mobile data communication networks, AMPS, TDMA, CDMA, PCS,etc., whereas a mobile device 700 intended for use in Europe may beconfigured to operate with the General Packet Radio Service (GPRS) datacommunication network and the Global System for Mobile Communications(GSM) voice communication network. Other types of data and voicenetworks, both separate and integrated, may also be utilized with amobile device 700.

Depending upon the type of network or networks 719, the accessrequirements for the mobile device 700 may also vary. For example, inthe Mobitex and DataTAC-data networks, mobile devices are registered onthe network using a unique identification number associated with eachmobile device. In GPRS data networks, however, network access isassociated with a subscriber or user of a mobile device. A GPRS devicetypically requires a subscriber identity module (SIM), which is requiredin order to operate a mobile device on a GPRS network. Local ornon-network communication functions (if any) may be operable, withoutthe SIM device, but a mobile device will be unable to carry out anyfunctions involving communications over the data network 719, other thanany legally required operations, such as ‘911’ emergency calling.

After any required network registration or activation procedures havebeen completed, the mobile device 700 may the send and receivecommunication signals, including both voice and data signals, over thenetworks 719. Signals received by the antenna 716 from the communicationnetwork 719 are routed to the receiver 712, which provides for signalamplification, frequency down conversion, filtering, channel selection,etc., and may also provide analog to digital conversion. Analog todigital conversion of the received signal allows more complexcommunication functions, such as digital demodulation and decoding to beperformed using the DSP 720. In a similar manner, signals to betransmitted to the network 719 are processed, including modulation andencoding, for example, by the DSP 720 and are then provided to thetransmitter 714 for digital to analog conversion, frequency upconversion, filtering, amplification and transmission to thecommunication network 719 via the antenna 718.

In addition to processing the communication signals, the DSP 720 alsoprovides for transceiver control. For example, the gain levels appliedto communication signals in the receiver 712 and the transmitter 714 maybe adaptively controlled through automatic gain control algorithmsimplemented in the DSP 720. Other transceiver control algorithms couldalso be implemented in the DSP 720 in order to provide moresophisticated control of the transceiver 711.

The microprocessor 738 preferably manages and controls the overalloperation of the mobile device 700. Many types of microprocessors ormicrocontrollers could be used here, or, alternatively, a single DSP 720could be used to carry out the functions of the microprocessor 738.Low-level communication functions, including at least data and voicecommunications, are performed through the DSP 720 in the transceiver711. Other, high-level communication applications, such as a voicecommunication application 724A, and a data communication application724B may be stored in the Flash memory 724 for execution by themicroprocessor 738. For example, the voice communication module 724A mayprovide a high-level user interface operable to transmit and receivevoice calls between the mobile device 700 and a plurality of other voiceor dual-mode devices via the network 719. Similarly, the datacommunication module 724B may provide a high-level user interfaceoperable for sending and receiving data, such as e-mail messages, files,organizer information, short text messages, etc., between the mobiledevice 700 and a plurality of other data devices via the networks 719.The microprocessor 738 also interacts with other device subsystems, suchas the display 722, Flash memory 724, RAM 726, auxiliary input/output(I/O) subsystems 728, serial port 730, keyboard 732, speaker 734,microphone 736, a short-range communications subsystem 740 and any otherdevice subsystems generally designated as 742.

Some of the subsystems shown in FIG. 7 perform communication-relatedfunctions, whereas other subsystems may provide “resident” or on-devicefunctions. Notably, some subsystems, such as keyboard 732 and display722 may be used for both communication-related functions, such asentering a text message for transmission over a data communicationnetwork, and device-resident functions such as a calculator or task listor other PDA type functions.

Operating system software used by the microprocessor 738 is preferablystored in a persistent store such as Flash memory 724. In addition tothe operating system, which controls low-level functions of the mobiledevice 710, the Flash memory 724 may include a plurality of high-levelsoftware application programs, or modules, such as a voice communicationmodule 724A, a data communication module 724B, an organizer module (notshown), or any other type of software module 724N. These modules areexecuted by the microprocessor 738 and provide a high-level interfacebetween a user and the mobile device 700. This interface typicallyincludes a graphical component provided through the display 722, and aninput/output component provided through the auxiliary I/O 728, keyboard732, speaker 734, and microphone 736. The operating system, specificdevice applications or modules, or parts thereof, may be temporarilyloaded into a volatile store, such as RAM 726 for faster operation.Moreover, received communication signals may also be temporarily storedto RAM 726, before permanently writing them to a file system located ina persistent store such as the Flash memory 724.

An exemplary application module 724N that may be loaded onto the mobiledevice 700 is a personal information manager (PIM) application providingPDA functionality, such as calendar events, appointments, and taskitems. This module 724N may also interact with the voice communicationmodule 724A for managing phone calls, voice mails, etc., and may alsointeract with the data communication module for managing e-mailcommunications and other data transmissions. Alternatively, all of thefunctionality of the voice communication module 724A and the datacommunication module 724B may be integrated into the PIM module.

The Flash memory 724 preferably also provides a file system tofacilitate storage of PIM data items on the device. The PIM applicationpreferably includes the ability to send and receive data items, eitherby itself, or in conjunction with the voice and data communicationmodules 724A, 724B, via the wireless networks 719. The PIM data itemsare preferably seamlessly integrated, synchronized and updated, via thewireless networks 719, with a corresponding set of data items stored orassociated with a host computer system, thereby creating a mirroredsystem for data items associated with a particular user.

Other types of software applications that may be installed on the mobiledevice 700 include secure communications applications enabling securemessaging, as well as banking and other e-commerce and m-commerceapplications, for example. The common CA interface 306, 406 and/orcommon crypto interface 411 may be implemented as further softwaremodules in the Flash memory 724, RAM 726, or another memory (not shown)in the mobile device 700. Any applications enabling or requiring securecommunications may then use the common interfaces for public-key cryptooperations as described above.

The mobile device 700 may be manually synchronized with a host system byplacing the device 700 in an interface cradle, which couples the serialport 730 of the mobile device 700 to the serial port of a computersystem or device. The serial port 730 may also be used to enable a userto set preferences through an external device or software application,or to download other application modules 724N for installation. Thiswired download path may be used to load an encryption key onto thedevice, which is a more secure method than exchanging encryptioninformation via the wireless network 719. Interfaces for other wireddownload paths may be provided in the mobile device 700, in addition toor instead of the serial port 730. For example, a USB port would providean interface to a similarly equipped personal computer.

Additional application modules 724N may be loaded onto the mobile device700 through the networks 719, through an auxiliary I/O subsystem 728,through the serial port 730, through the short-range communicationssubsystem 740, or through any other suitable subsystem 742, andinstalled by a user in the Flash memory 724 or RAM 726. Such flexibilityin application installation increases the functionality of the mobiledevice 700 and may provide enhanced on-device functions,communication-related functions, or both. For example, securecommunication applications may enable electronic commerce functions andother such financial transactions to be performed using the mobiledevice 700.

When the mobile device 700 is operating in a data communication mode, areceived signal, such as a text message or a web page download, will beprocessed by the transceiver module 711 and provided to themicroprocessor 738, which will preferably further process the receivedsignal for output to the display 722, or, alternatively, to an auxiliaryI/O device 728. A user of mobile device 700 may also compose data items,such as e-mail messages, using the keyboard 732, which is preferably acomplete alphanumeric keyboard laid out in the QWERTY style, althoughother styles of complete alphanumeric keyboards such as the known DVORAKstyle may also be used. User input to the mobile device 700 is furtherenhanced with a plurality of auxiliary I/O devices 728, which mayinclude a thumbwheel input device, a touchpad, a variety of switches, arocker input switch, etc. The composed data items input by the user maythen be transmitted over the communication networks 719 via thetransceiver module 711.

When the mobile device 700 is operating in a voice communication mode,the overall operation of the mobile device is substantially similar tothe data mode, except that received signals are preferably be output tothe speaker 734 and voice signals for transmission are generated by amicrophone 736. Alternative voice or audio I/O subsystems, such as avoice message recording subsystem, may also be implemented on the mobiledevice 700. Although voice or audio signal output is preferablyaccomplished primarily through the speaker 734, the display 722 may alsobe used to provide an indication of the identity of a calling party, theduration of a voice call, or other voice call related information. Forexample, the microprocessor 738, in conjunction with the voicecommunication module and the operating system software, may detect thecaller identification information of an incoming voice call and displayft on the display 722.

A short-range communications subsystem 740 may also be included in themobile device 700. For example, the subsystem 740 may include aninfrared device and associated circuits and components, or a short-rangeRF communication module such as a Bluetooth™ module or an 802.11 moduleto provide for communication with similarly-enabled systems and devices.Those skilled in the art will appreciate that “Bluetooth” and “802.11”refer to sets of specifications, available from the Institute ofElectrical and Electronics Engineers, relating to wireless personal areanetworks and wireless local area networks, respectively.

1. (canceled)
 2. A communication device, comprising: a commoncertification authority (CA) interface that communicates asecurity-related request to one of a plurality of CA providercomponents; the CA provider component configured to send thesecurity-related request received from the common CA interface to itsrespective associated CA by wired or wireless electronic communication.3. The communication device of claim 2, further comprising: anapplication communication link that exchanges data between the common CAinterface and a software application.
 4. The communication device ofclaim 2, wherein the communication device is selected from the groupconsisting of: a data communication device, a voice communicationdevice, a dual-mode communication device enabled for both voice and datacommunications, a mobile telephone having data communicationscapabilities, a two-way pager, a personal digital assistant (PDA)enabled for communications, and a desktop, palmtop or laptop computerhaving a wireless modem.
 5. The communication device of claim 3, whereinthe software application is a banking application.
 6. The communicationdevice of claim 3, wherein the software application is an electronicmessaging application.
 7. The communication device of claim 2, whereinthe security-related request includes an encryption or digitalsignature-related request.
 8. The communication device of claim 2,wherein the security-related request includes a request for a public keyfrom a CA associated with one of the plurality of CA providercomponents.
 9. The communication device of claim 2, wherein thesecurity-related request includes a request to register a public keywith a CA associated with one of the plurality of CA providercomponents.
 10. The communication device of claim 3, wherein thesoftware application is associated with a particular CA, and wherein thecommon CA interface communicates the security-related request to the oneCA provider component based on the particular CA associated with thesoftware application.
 11. A multiple certification authority (CA)handler comprising instructions to: receive a security-related requestfrom a first application; determine among a plurality of CA providercomponents which of the CA provider components are associated with thefirst application; and communicate the security-related request to theassociated CA provider.
 12. The multiple certification authority (CA)handler of claim 11, further comprising instructions to change the CAprovider that is associated with the first application.
 13. The multiplecertification authority (CA) handler of claim 11, further comprisinginstructions to add a second CA provider that is associated with thefirst application.
 14. The multiple certification authority (CA) handlerof claim 11, further comprising instructions to communicate thesecurity-related request to a plurality of associated CA providers. 15.The multiple certification authority (CA) handler of claim 11, furthercomprising instructions to remove a CA provider that is associated withthe first application.
 16. The multiple certification authority (CA)handler of claim 11, wherein the multiple CA handler resides on acommunication device.
 17. The multiple certification authority (CA)handler of claim 16, wherein the communication device is selected fromthe group consisting of: a data communication device, a voicecommunication device, a dual-mode communication device enabled for bothvoice and data communications, a mobile telephone having datacommunications capabilities, a two-way pager, a personal digitalassistant (PDA) enabled for communications, and a desktop, palmtop orlaptop computer having a wireless modem.
 18. A method implemented on amobile device, comprising the steps of: receiving a security-relatedrequest from a first application; determining among a plurality of CAprovider components which of the CA provider components are associatedwith the first application; and communicating the security-relatedrequest to the associated CA provider.
 19. The method of claim 18,further comprising the step of: changing the CA provider that isassociated with the first application.
 20. The method of claim 18,further comprising the step of: adding a second CA provider that isassociated with the first application.
 21. The method of claim 18,further comprising the step of: removing a CA provider that isassociated with the first application.